CVE-2010-3933
rubyonrails rails: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days. Fixed in activerecord 2.3.10, 3.0.1.
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gjxw-5w2q-7grf | RubyGems | activerecord | >=2.3.9 <2.3.10 | 2.3.10 |
| GHSA-gjxw-5w2q-7grf | RubyGems | activerecord | >=3.0.0 <3.0.1 | 3.0.1 |